diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c
index 1c021ac5fa..6fe2cc97f6 100644
--- a/libavcodec/smacker.c
+++ b/libavcodec/smacker.c
@@ -284,6 +284,12 @@ static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int
         av_log(smk->avctx, AV_LOG_ERROR, "bigtree damaged\n");
         return AVERROR_INVALIDDATA;
     }
+    if (ctx.last[0] >= huff.length ||
+        ctx.last[1] >= huff.length ||
+        ctx.last[2] >= huff.length) {
+        av_log(smk->avctx, AV_LOG_ERROR, "Huffman codes out of range\n");
+        err = AVERROR_INVALIDDATA;
+    }
 
     *recodes = huff.values;